CVE-2026-4544: XSS in Wavlink WL-WN578W2

Successful exploitation of CVE-2026-4544 allows an attacker to inject arbitrary JavaScript code into the web interface of the Wavlink WL-WN578W2 router. This can be leveraged to steal user cookies, redirect users to malicious websites, or even deface the router's login page. Given the router's role as a gateway to a home or small business network, a compromised router could serve as a launching point for further attacks against internal systems. The ability to execute code remotely significantly increases the potential impact, as attackers do not need physical access to the device.

1. Reserved2026-03-21
2. Published2026-03-22
3. Modified2026-03-23
4. EPSS updated2026-03-29

Due to the vendor's lack of response, direct patching is unavailable. As a workaround, implement strict input validation on the homepage/hostname/login_page parameter within the /cgi-bin/login.cgi script, if possible. Consider using a Web Application Firewall (WAF) to filter out malicious requests containing suspicious JavaScript code. Regularly monitor router logs for unusual activity, particularly requests targeting /cgi-bin/login.cgi with unusual parameters. After implementing these mitigations, verify their effectiveness by attempting to inject a simple JavaScript payload and confirming it is blocked.